Hello,

@mikelolasagasti found XSS in the comment notification email.

This advisory is assigned GHSA-623h-px8r-9643.

CVE is pending.

Affected code:

# app/views/mailer/comment_notification.html.erb

<%= @comment.body.to_s.gsub("\n", "<br>").html_safe %>

Fixed version:

<%= simple_format(@comment.body) %>

Fix in PR: https://github.com/errbit/errbit/pull/3094

Fix released in Errbit version: v0.11.5.

Workaround: Make sure that you are using an email client that properly sanitizes the HTML body of the email.